Platform security and availability

This page describes the transport encryption, perimeter protections, and availability measures that Alpacon operates on the platform side. For how your servers connect and how to configure your network, see Network security. For how your data is stored and protected, see Data security.

Encryption in transit

All connections between your browser, the CLI, the Alpamon agent, and the platform are encrypted with TLS.

  • TLS 1.3 preferred, TLS 1.2 minimum: Older protocol versions are not accepted.
  • Strong cipher suites only: AES-256-GCM and ChaCha20-Poly1305.
  • Perfect forward secrecy: ECDHE key exchange, so a future key compromise cannot decrypt past traffic.
  • HSTS: HTTP Strict Transport Security is enforced, so browsers only ever connect over HTTPS.
  • Certificate validation: Enabled by default. The Alpamon agent verifies the server certificate and can be configured with a custom CA bundle for environments that terminate TLS internally.

Real-time features such as terminal sessions and live monitoring run over encrypted WebSocket (WSS) connections on the same TLS foundation. Terminal traffic is relayed through Alpacon so that sessions can be recorded and audited; see Data security for how this works and why.

Data stored by the platform is encrypted at rest with AES-256. See Data security for details.

Certificate management

Alpacon uses managed certificate authorities with automated renewal, so certificates never require manual rotation:

  • AWS-hosted surfaces: Certificates are issued and renewed through AWS Certificate Manager (ACM).
  • Self-hosted surfaces: Certificates are issued and renewed through Let’s Encrypt.

Workspace subdomains (<workspace>.<region>.alpacon.io) are covered by wildcard certificates.

Perimeter and abuse protection

Network and application firewall

  • Web application firewall: AWS WAF inspects incoming HTTP requests and blocks common web attacks.
  • DDoS protection: Network and transport-layer (L3/L4) protection is provided by AWS Shield Standard, which is always on for our AWS-hosted infrastructure.

Rate limiting and account protection

  • API rate limiting: Programmatic access authenticated with service tokens is rate-limited, with a configurable per-token limit and per-token IP allowlists. See Service tokens.
  • Brute-force protection: Repeated failed sign-in attempts trigger a temporary lockout.

Monitoring and detection

  • Continuous monitoring: Platform and infrastructure metrics and logs are collected and monitored around the clock with Datadog and AWS CloudWatch.
  • Dependency scanning: Repositories are continuously scanned for vulnerable dependencies with GitHub Dependabot.
  • Public status page: Live and historical service status is published at status.alpacax.com.

Availability

  • Managed infrastructure: The platform runs on AWS across regional availability zones.
  • Point-in-time recovery: Managed databases support point-in-time recovery.
  • Disaster-recovery testing: We run disaster-recovery tests on a regular cadence to validate recovery procedures.
  • Status transparency: Incidents and maintenance are posted to the public status page.

For backup strategy, data residency, and recovery objectives, see Data security.

Contact

For platform security inquiries, including security questionnaires and documentation requests:

Last updated: